diff options
| author | Oleg Nesterov <oleg@redhat.com> | 2011-04-26 22:37:11 +0200 |
|---|---|---|
| committer | Chris Metcalf <cmetcalf@tilera.com> | 2011-05-04 14:41:53 -0400 |
| commit | ceca3c193e73bb409d093515fae9e5ef02ffa2de (patch) | |
| tree | b29f24fb0c280dd04bc4cdd0d68ffdec06e48ad7 | |
| parent | dc0b124d8edc6c2f95fc3a689cd40ec05ad85108 (diff) | |
| download | kernel_samsung_espresso10-ceca3c193e73bb409d093515fae9e5ef02ffa2de.zip kernel_samsung_espresso10-ceca3c193e73bb409d093515fae9e5ef02ffa2de.tar.gz kernel_samsung_espresso10-ceca3c193e73bb409d093515fae9e5ef02ffa2de.tar.bz2 | |
tile: do_hardwall_trap: do not play with task->sighand
1. do_hardwall_trap() checks ->sighand != NULL and then takes ->siglock.
This is unsafe even if the task can't run (I assume it is pinned to
the same CPU), its parent can reap the task and set ->sighand = NULL
right after this check. Even if the compiler dosn't read ->sighand
twice and this memory can't to away __group_send_sig_info() is wrong
after that. Use do_send_sig_info().
2. Send SIGILL to the thread, not to the whole process. Unless it has
the handler or blocked this kills the whole thread-group as before.
IIUC, different threads can be bound to different rect's.
3. Check PF_EXITING instead of ->sighand. A zombie thread can go away
but its ->sighand can be !NULL.
Reported-by: Matt Fleming <matt@console-pimps.org>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
| -rw-r--r-- | arch/tile/kernel/hardwall.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/arch/tile/kernel/hardwall.c b/arch/tile/kernel/hardwall.c index e910530..3bddef7 100644 --- a/arch/tile/kernel/hardwall.c +++ b/arch/tile/kernel/hardwall.c @@ -268,12 +268,10 @@ void __kprobes do_hardwall_trap(struct pt_regs* regs, int fault_num) found_processes = 0; list_for_each_entry(p, &rect->task_head, thread.hardwall_list) { BUG_ON(p->thread.hardwall != rect); - if (p->sighand) { + if (!(p->flags & PF_EXITING)) { found_processes = 1; pr_notice("hardwall: killing %d\n", p->pid); - spin_lock(&p->sighand->siglock); - __group_send_sig_info(info.si_signo, &info, p); - spin_unlock(&p->sighand->siglock); + do_send_sig_info(info.si_signo, &info, p, false); } } if (!found_processes) |